diff --git a/README.md b/README.md
index 77cdc13..57fd19b 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,129 @@
 # NullCart Promo Website
 
-Static promo landing page for [NullCart](https://git.nobswebdev.com/nobswebdev/nullcart) — HTML and CSS only, zero JavaScript.
+Static promo landing page for [NullCart](https://git.nobswebdev.com/nobswebdev/nullcart) - HTML and CSS only, zero JavaScript.
+
+## Development
+
+No Docker required locally. Open `index.html` in your browser.
+
+## Production
+
+### 1. Requirements
+
+- Ubuntu 22.04+ or similar Linux with Docker Engine and the Compose plugin — follow [Install Docker Engine on Ubuntu](https://docs.docker.com/engine/install/ubuntu/#install-using-the-repository)
+- A domain name pointing at your server (A records for apex and `www`)
+
+### 2. Server setup
+
+Deploy as **root** on the VPS.
+
+Verify:
+
+```bash
+docker compose version
+```
+
+### 3. Clone the repository
+
+```bash
+cd /root
+git clone https://git.nobswebdev.com/nobswebdev/nullcart_promo_website.git nullcart_promo_website
+cd nullcart_promo_website
+```
+
+### 4. Configure environment
+
+```bash
+cd /root/nullcart_promo_website
+cp .env.example .env.prod
+chmod 600 .env.prod
+```
+
+Edit `.env.prod`:
+
+| Variable               | Production value               |
+| ---------------------- | ------------------------------ |
+| `COMPOSE_PROJECT_NAME` | `nullcart_promo_prod`          |
+| `CLEARNET_DOMAIN`      | apex only, e.g. `nullcart.net` |
+
+### 5. Bootstrap TLS certificates
+
+Nginx needs certificate files before it can start on port 443. For the **first** deploy, create a temporary self-signed pair (replaced after Let's Encrypt):
+
+```bash
+./deploy/scripts/bootstrap-certs.sh
+```
+
+After the stack is running, obtain real certificates (step 7).
+
+### 6. Start the stack
+
+```bash
+./deploy/scripts/deploy.sh
+```
+
+Check containers:
+
+```bash
+docker compose --env-file .env.prod -f docker-compose.prod.yml ps
+```
+
+### 7. Issue Let's Encrypt certificates
+
+Remove the temporary bootstrap certificates under `deploy/certs/live/` (Certbot cannot issue into the layout created by `bootstrap-certs.sh`):
+
+```bash
+rm -rf deploy/certs/live/*
+```
+
+Request the real certificate (apex + www):
+
+```bash
+./deploy/scripts/issue-certs.sh --email you@example.com
+```
+
+Reload nginx:
+
+```bash
+docker compose --env-file .env.prod -f docker-compose.prod.yml exec nginx nginx -s reload
+```
+
+#### Automatic renewal
+
+Open root's crontab:
+
+```bash
+crontab -e
+```
+
+Add a weekly job (`/root/nullcart_promo_website` is the standard deploy path):
+
+```cron
+0 3 * * 0 /root/nullcart_promo_website/deploy/scripts/renew-certs.sh >> /var/log/nullcart-promo-cert-renew.log 2>&1
+```
+
+Save and exit the editor. Optional — run once manually to verify:
+
+```bash
+/root/nullcart_promo_website/deploy/scripts/renew-certs.sh
+```
+
+### 8. Tor onion address
+
+```bash
+./deploy/scripts/show-onion.sh
+```
+
+Update onion links in `index.html` if needed, then redeploy:
+
+```bash
+./deploy/scripts/deploy.sh
+```
+
+### 9. Updates
+
+```bash
+./deploy/scripts/update.sh
+```
+
+This pulls the latest code and rebuilds the stack (`deploy.sh`).